spc-grafeno-login@1.0.0

Analysis

The preinstall hook (preinstall.js) harvests the installer's environment variables matching AWS/TOKEN/KEY/SECRET/PASS/API/GITHUB/NPM/DOCKER/DB/MONGO/REDIS/POSTGRES/MYSQL, base64-encodes them, and exfiltrates them via curl to hxxp://216[.]126[.]236[.]46/r[.]php?d=<encoded-data>. It then spawns a reverse shell to 216[.]126[.]236[.]46:4444 using bash /dev/tcp, nc -e, or a python3 socket fallback. All errors are silently swallowed.